Was a timejacking attack ever performed?

Question

The timejacking attack appears to be a pretty straightforward attack to pull off successfully. I was wondering, whether it was ever performed and documented somewhere, or was it just theoretically described?

Answer 1

For those of you who are wondering what TimeJacking is, please consider the following:

In order for computers and machines, separated by vast distances, to work in tandem, they usually have to be synchronized. If the time and date aren't isn't synchronized, this can lead to issues relating to security, usability, and overall response time. According to NTP.org:

http://www.ntp.org/ntpfaq/NTP-s-def.htm

"If you have communicating programs running on different computers, time still should even advance if you switch from one computer to another. Obviously if one system is ahead of the others, the others are behind that particular one. From the perspective of an external observer, switching between these systems would cause time to jump forward and back, a non-desirable effect. As a consequence, isolated networks may run their own wrong time, but as soon as you connect to the Internet, effects will be visible .... Even on a single computer some applications have trouble when the time jumps backwards. For example, database systems using transactions and crash recovery like to know the time of the last good state."

This also applies to online security certificates (in browser). If the time and date is wrong, strange things may happen (invalid certificate error).

While this appears to apply only to the Network Time Protocol, I assure you otherwise - networked systems need to stay synced in order to function. BlockChain and other cryptocurrency handlers have this exact issue because they are handling electronic transactions over vast distances, across time-zones.

Oh wait - in case you don't know what a bitcoin node is:

http://www.coindesk.com/bitcoin-nodes-need/

Now that we know how the system crack can occur, let's delve into the process (good source, BTW - ThePiachu):

(Presented by culubas: Timejacking and BitCoin - Blogspot)

"Each node internally maintains a counter that represents the network time. This is based on the median time of a node's peers which is sent in the version message when peers connect. The network time counter reverts to the system time however if the median time differs by more than 70 minutes from the system time. A very reasonable way to estimate the median network time.

An attacker could potentially slow down or speed up a node's network time counter by connecting as multiple peers and reporting inaccurate time-stamps. (A relatively small number of Tor clients could send enough messages to take over the node's median time.)"

As usual, time is used for security and validation on these monetary hardware servers and nodes. If the time is off, bad things can happen. For more info on how an actual cracking attempt could occur, read the section labeled "Creating a 'Poison Pill' Block" of culubas blogpost cited above.

In short, an attempted hack would create a perceived time gap between the mining machines and node targeted, by lagging part of the system until one of three things occur: either an unaffected node or the target itself creates a block, clocks are reset, or operators intervene. As such, valid blocks could be dropped, and money could be lost or stolen. Please read the original article for more info.

Now, as for the question at hand, I wasn't able to find any confirmed instances of TimeJacking so far. That could be due to a variety of reasons, but I personally think that no one has chosen to target the cryptocurrency yet. In that case, I can't wait to see what a new API update would look like - especially with some new security patches for P2p time-keeping and network certificates. Sadly, it could be just a matter of time.